Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

RagnarLocker – Silent VirtualBox Deployment for EDR-Evading Encryption

Ragnarlocker Defense Evasion Sentinel
MITRE ATT&CK
Run Virtual Instance
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
Sophos 2020 RagnarLocker VirtualBox research; ransomware.live group_tools dataset (ragnarlocker)
What This Detects
RagnarLocker's signature EDR-evasion technique – documented by Sophos in 2020 – runs the encryptor inside a stripped-down Windows XP VirtualBox VM with host drives mounted, so security tools on the host never see the payload execute. Flags VirtualBox binaries installed and run in close succession.
Query
let vboxInstall = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName in~ ("vboxheadless.exe","virtualbox.exe","vboxmanage.exe")
| project DeviceName, InstallTime = Timestamp, FileName;
let vboxRun = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("vboxheadless.exe","vboxmanage.exe")
| project DeviceName, RunTime = Timestamp;
vboxInstall
| join kind=inner vboxRun on DeviceName
| where RunTime - InstallTime between (0min .. 6h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.